EUVD-2026-46284
GHSA-q3fm-5c2w-6758
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires an authenticated group admin (PR:H) reachable over the network (AV:N) with no interaction; IDOR crosses authority to root RCE, justifying S:C and C/I/A:H.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments.
Technical ContextAI
Serv-U is SolarWinds' managed file transfer (MFT) and secure file server platform (CPE cpe:2.3:a:solarwinds:serv-u), commonly exposing FTP/FTPS/SFTP/HTTP(S) services and a delegated administration model with 'group administrators' who manage a subset of the server. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the application authorizes an action based on a client-supplied object identifier without verifying the requesting group administrator actually owns or is entitled to that object. By substituting or forging these references, the actor reaches privileged objects/configuration that translate into code execution in the security context of the Serv-U service - root on Linux/Unix, and a more constrained context on Windows where the daemon typically does not run with equivalent system-wide authority.
RemediationAI
Patch available per vendor advisory: upgrade Serv-U to the fixed release documented in the Serv-U 2026-3 release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) and follow the CVE advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302; the exact patched build number should be confirmed against those pages before deployment. Because exploitation requires group administrator access, the highest-value compensating control until patching is to reduce and tightly vet who holds group-admin roles - remove or downgrade delegated administrators who do not need it, and treat group-admin as a trusted-insider boundary (side effect: reduced delegation flexibility for multi-tenant operations). Additionally, restrict network exposure of the Serv-U management interface to trusted admin networks or a VPN to limit who can reach the authenticated admin surface (trade-off: remote admins must connect via the restricted path), and monitor admin activity/logs for anomalous object references or configuration changes. Prioritizing Linux/Unix hosts first is reasonable since Windows impact is lower.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today